@camstack/types 1.2.122 → 1.2.124

package/dist/addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BaEgqJNv.js");
-const require_sleep = require("./sleep-DUxF5DdC.js");
+const require_sleep = require("./sleep-CJrvRDlD.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/addon.mjs

@@ -1,5 +1,5 @@
 import { t as EventCategory } from "./event-category-BZL-fdNj.mjs";
-import { B as ReadinessRegistry, E as adminUiCapability, L as nodePin, R as readNodePin, St as emitReadiness, T as DeviceType, V as ReadinessTimeoutError, W as scopeKey, _t as DisposerChain, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, gt as DATAPLANE_SECRET_HEADER, h as createEventBusSliceSource, j as expandCapMethods, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, vt as BaseAddon, x as viewerUiCapability, yt as normalizeAddonInitResult } from "./sleep-C9C8EoK8.mjs";
+import { B as ReadinessRegistry, E as adminUiCapability, L as nodePin, R as readNodePin, St as emitReadiness, T as DeviceType, V as ReadinessTimeoutError, W as scopeKey, _t as DisposerChain, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, gt as DATAPLANE_SECRET_HEADER, h as createEventBusSliceSource, j as expandCapMethods, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, vt as BaseAddon, x as viewerUiCapability, yt as normalizeAddonInitResult } from "./sleep-L5-bG_a_.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/capabilities/intercom.cap.d.ts

@@ -69,6 +69,33 @@ export declare const intercomCapability: {
     readonly deviceNative: true;
     readonly mode: "singleton";
     readonly deviceTypes: readonly [DeviceType.Camera];
+    /**
+     * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+     *
+     * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+     * cap has no configuration surface at all: all six methods open, feed and
+     * close one live audio session against one `deviceId`. That is the same
+     * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+     * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+     * `admin` because they change what the device IS.
+     *
+     * `protected` does not mean ungated: `protectedProcedure` runs the
+     * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+     * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+     * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+     * only) still cannot talk, and a grant on camera 5 cannot talk through
+     * camera 7.
+     *
+     * Every method was `auth: 'admin'` from the initial commit, which made the
+     * cap unreachable by every non-admin principal — `adminProcedure` throws
+     * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+     * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+     * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+     * `camera-operator` scope preset has promised "PTZ control, intercom,
+     * snapshots" since that same commit; the promise could not be kept. Recorded
+     * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+     * preset promises a cap no row of that preset can reach.
+     */
     readonly methods: {
         /**
          * Open a server-side WebRTC audio-only session. Returns an SDP

package/dist/capabilities/pipeline-analytics.cap.d.ts

@@ -2394,6 +2394,11 @@ export declare const pipelineAnalyticsCapability: {
         readonly startStorageMigrationMove: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             toLocationId: z.ZodString;
             throttleMbps: z.ZodOptional<z.ZodNumber>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                move: "move";
+                seal: "seal";
+                gallery: "gallery";
+            }>>;
             leaseId: z.ZodString;
         }, z.core.$strip>, z.ZodObject<{
             jobId: z.ZodString;
@@ -2436,9 +2441,29 @@ export declare const pipelineAnalyticsCapability: {
         readonly relocateMedia: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             toLocationId: z.ZodString;
             throttleMbps: z.ZodOptional<z.ZodNumber>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                move: "move";
+                seal: "seal";
+                gallery: "gallery";
+            }>>;
         }, z.core.$strip>, z.ZodObject<{
             jobId: z.ZodString;
         }, z.core.$strip>, "mutation">;
+        /**
+         * How many media / retrain rows still carry NO `locationId`.
+         *
+         * A NULL row means "wherever `eventMedia` points NOW", so the instant a
+         * repoint moves that pointer every such row reads from the new disk while
+         * its bytes are on the old one — the archive goes dark until a drain
+         * happens to stamp it. This count is what the migration planner's
+         * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
+         * it to zero.
+         */
+        readonly countUnstampedEventMedia: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            media: z.ZodNumber;
+            retrainFrames: z.ZodNumber;
+            total: z.ZodNumber;
+        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
         /** Every relocate job this addon knows about, newest first (in RAM: the
          *  move is resumable, so a lost list costs nothing but the display). */
         readonly listRelocateMediaJobs: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{

package/dist/capabilities/storage-migration.cap.d.ts

@@ -15,31 +15,68 @@ export declare const storageMigrationCapability: {
                 recordings: z.ZodOptional<z.ZodString>;
                 recordingsLow: z.ZodOptional<z.ZodString>;
                 eventMedia: z.ZodOptional<z.ZodString>;
+                backups: z.ZodOptional<z.ZodString>;
+                galleryMedia: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
             throttleMbps: z.ZodOptional<z.ZodNumber>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                blocking: "blocking";
+                nonBlocking: "nonBlocking";
+            }>>;
         }, z.core.$strip>, z.ZodObject<{
             destinations: z.ZodObject<{
                 recordings: z.ZodOptional<z.ZodString>;
                 recordingsLow: z.ZodOptional<z.ZodString>;
                 eventMedia: z.ZodOptional<z.ZodString>;
+                backups: z.ZodOptional<z.ZodString>;
+                galleryMedia: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
+            mode: z.ZodEnum<{
+                blocking: "blocking";
+                nonBlocking: "nonBlocking";
+            }>;
             moves: z.ZodArray<z.ZodObject<{
                 storageClass: z.ZodEnum<{
                     recordings: "recordings";
                     recordingsLow: "recordingsLow";
                     eventMedia: "eventMedia";
+                    backups: "backups";
+                    galleryMedia: "galleryMedia";
                 }>;
                 fromLocationId: z.ZodString;
                 toLocationId: z.ZodString;
             }, z.core.$strip>>;
+            findings: z.ZodArray<z.ZodObject<{
+                code: z.ZodEnum<{
+                    sharesDeviceWithSource: "sharesDeviceWithSource";
+                    deviceIdentityUnknown: "deviceIdentityUnknown";
+                    unstampedEventMediaRows: "unstampedEventMediaRows";
+                    blockingOnly: "blockingOnly";
+                    noMover: "noMover";
+                }>;
+                storageClass: z.ZodEnum<{
+                    recordings: "recordings";
+                    recordingsLow: "recordingsLow";
+                    eventMedia: "eventMedia";
+                    backups: "backups";
+                    galleryMedia: "galleryMedia";
+                }>;
+                message: z.ZodString;
+            }, z.core.$strip>>;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
         readonly start: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             destinations: z.ZodObject<{
                 recordings: z.ZodOptional<z.ZodString>;
                 recordingsLow: z.ZodOptional<z.ZodString>;
                 eventMedia: z.ZodOptional<z.ZodString>;
+                backups: z.ZodOptional<z.ZodString>;
+                galleryMedia: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
             throttleMbps: z.ZodOptional<z.ZodNumber>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                blocking: "blocking";
+                nonBlocking: "nonBlocking";
+            }>>;
         }, z.core.$strip>, z.ZodObject<{
             jobId: z.ZodString;
         }, z.core.$strip>, "mutation">;
@@ -54,15 +91,23 @@ export declare const storageMigrationCapability: {
                 done: "done";
                 cancelled: "cancelled";
                 planning: "planning";
+                sealing: "sealing";
                 pausing: "pausing";
+                draining: "draining";
                 repointing: "repointing";
                 refreshing: "refreshing";
                 resuming: "resuming";
             }>;
+            mode: z.ZodEnum<{
+                blocking: "blocking";
+                nonBlocking: "nonBlocking";
+            }>;
             destinations: z.ZodObject<{
                 recordings: z.ZodOptional<z.ZodString>;
                 recordingsLow: z.ZodOptional<z.ZodString>;
                 eventMedia: z.ZodOptional<z.ZodString>;
+                backups: z.ZodOptional<z.ZodString>;
+                galleryMedia: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
             throttleMbps: z.ZodNumber;
             moves: z.ZodArray<z.ZodObject<{
@@ -70,6 +115,8 @@ export declare const storageMigrationCapability: {
                     recordings: "recordings";
                     recordingsLow: "recordingsLow";
                     eventMedia: "eventMedia";
+                    backups: "backups";
+                    galleryMedia: "galleryMedia";
                 }>;
                 fromLocationId: z.ZodString;
                 toLocationId: z.ZodString;

package/dist/capabilities/storage.cap.d.ts

@@ -169,8 +169,23 @@ export declare const storageCapability: {
             createdAt: z.ZodNumber;
             updatedAt: z.ZodNumber;
         }, z.core.$strip>, "mutation">;
+        /**
+         * Remove a location record. REFUSES a location that still holds data —
+         * deleting a drained location whose durable rows still name it is how this
+         * hub acquired 2 131 ghost `recordings:high` segments, and playback does
+         * not stat, so the operator sees a silent black window rather than an
+         * error.
+         *
+         * `force` exists because the occupancy check is BEST-EFFORT and refuses on
+         * "unknown" as well as on "occupied" (a read that fails must not authorise
+         * a destruction — D49). A location on a removed disk, on another node, or
+         * behind a remote provider answers "unknown" forever, and a refusal an
+         * operator cannot override is its own failure mode. `force: true` is
+         * logged, loudly, with what the check saw.
+         */
         readonly deleteLocation: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             id: z.ZodString;
+            force: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>, z.ZodVoid, "mutation">;
         readonly testLocation: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             id: z.ZodString;

package/dist/generated/addon-api.d.ts

@@ -5121,6 +5121,13 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof pipelineAnalyticsCapability.methods.relocateMedia.output>;
             meta: object;
         }>;
+        countUnstampedEventMedia: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof pipelineAnalyticsCapability.methods.countUnstampedEventMedia.input>;
+            output: z.infer<typeof pipelineAnalyticsCapability.methods.countUnstampedEventMedia.output>;
+            meta: object;
+        }>;
         listRelocateMediaJobs: TRPCQueryProcedure<{
             input: {
                 [x: string]: unknown;

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 978 method paths across 126 capabilities.
+ * Coverage: 979 method paths across 126 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BaEgqJNv.js");
-const require_sleep = require("./sleep-DUxF5DdC.js");
+const require_sleep = require("./sleep-CJrvRDlD.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -2225,18 +2225,61 @@ var RelocateFootageInputSchema = zod.z.object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = zod.z.object({ leaseId: zod.z.string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: zod.z.string().min(1) });
+/**
+* What a `relocateMedia` pass DOES. One engine, three passes — never a second
+* mover (the engine already walks both collections with a timestamp cursor and
+* already has a stamp-without-copy path).
+*
+*  - `move`    — the default and the historical behaviour: event-media and
+*                retrain blobs move to `toLocationId` and their rows are
+*                stamped. The enrolled gallery is skipped (D197).
+*  - `seal`    — ROWS ONLY, no bytes. Every row whose `locationId` is NULL is
+*                stamped with `toLocationId`. `toLocationId` here is the id the
+*                bytes ALREADY sit on — today's `eventMedia` default — because
+*                a NULL row means "wherever `eventMedia` points *now*", and the
+*                instant a repoint moves that pointer the row reads from the
+*                new disk while its bytes are on the old one.
+*  - `gallery` — the inverse selection of `move`: ONLY the retention-exempt
+*                (enrolled-gallery) rows, which `move` deliberately skips.
+*                `galleryMedia` is `cardinality: 'single'`, so this pass can
+*                never run beside a live second location: it is stop-the-world
+*                by construction, which is acceptable only because the gallery
+*                is a few KB per enrolled sample.
+*/
+var MediaRelocateModeSchema = zod.z.enum([
+	"move",
+	"seal",
+	"gallery"
+]);
 var RelocateMediaInputSchema = zod.z.object({
 	toLocationId: zod.z.string(),
-	throttleMbps: zod.z.number().min(1).max(1e3).optional()
+	throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+	/** Omitted = `move`, the pre-existing behaviour. */
+	mode: MediaRelocateModeSchema.optional()
+});
+/** How many rows still carry NO `locationId` — the population a repoint would
+*  silently re-aim at a disk that does not hold their bytes. Zero is the only
+*  value that permits a non-blocking `eventMedia` cutover. */
+var UnstampedEventMediaCountSchema = zod.z.object({
+	media: zod.z.number().int().nonnegative(),
+	retrainFrames: zod.z.number().int().nonnegative(),
+	total: zod.z.number().int().nonnegative()
 });
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
-/** The independently selectable logical storage classes. `recordings`
-* encompasses the high and mid segment profiles; `recordingsLow` is low
-* segments; `eventMedia` is post-analysis blobs. */
+/** The independently selectable logical storage classes — every class
+* `storage.listLocationDeclarations` reports, so an operator never meets a
+* Zod enum error where they should meet an explanation.
+*
+* `recordings` encompasses the high and mid segment profiles; `recordingsLow`
+* is low segments; `eventMedia` is post-analysis blobs; `galleryMedia` is the
+* enrolled gallery; `backups` is the system backup archive. The last two have
+* their own rules — see {@link StorageMigrationFindingCodeSchema}. */
 var StorageMigrationClassSchema = zod.z.enum([
 	"recordings",
 	"recordingsLow",
-	"eventMedia"
+	"eventMedia",
+	"backups",
+	"galleryMedia"
 ]);
 /** A destination is always an existing, fully-qualified location id. The
 * migration API intentionally never changes a source location's `basePath`:
@@ -2244,20 +2287,56 @@ var StorageMigrationClassSchema = zod.z.enum([
 var StorageMigrationDestinationsSchema = zod.z.object({
 	recordings: zod.z.string().min(1).optional(),
 	recordingsLow: zod.z.string().min(1).optional(),
-	eventMedia: zod.z.string().min(1).optional()
+	eventMedia: zod.z.string().min(1).optional(),
+	backups: zod.z.string().min(1).optional(),
+	galleryMedia: zod.z.string().min(1).optional()
 }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+/**
+* How a migration sequences the cutover against the byte move.
+*
+*  - `blocking`     — the historical order: pause, move every byte, repoint,
+*                     resume. Recording is stopped for the whole move. Right
+*                     for a small or a cold class, and the only legal mode for
+*                     a `cardinality: 'single'` class.
+*  - `nonBlocking`  — repoint FIRST, drain behind: seal, pause, repoint,
+*                     refresh, resume, then move the past with everything
+*                     running. The pause is three bounded instants (a detach +
+*                     attach round, a write-gate drain, a lease) instead of one
+*                     bounded by bytes. 1.09 TB at 7–14 MB/s is thirty hours of
+*                     stopped recording under `blocking`; the same move is
+*                     seconds of stopped recording under `nonBlocking`.
+*
+* The mode is on the JOB, not only on the input, because `status` is where an
+* operator finds out which one is running.
+*/
+var StorageMigrationModeSchema = zod.z.enum(["blocking", "nonBlocking"]);
 /** Shared input for planning and starting an orchestrated storage migration. */
 var StorageMigrationInputSchema = zod.z.object({
 	destinations: StorageMigrationDestinationsSchema,
-	throttleMbps: zod.z.number().min(1).max(1e3).optional()
+	throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+	/** Omitted = `blocking`, which stays the default. */
+	mode: StorageMigrationModeSchema.optional()
 });
-/** The durable coordinator state machine. The only phase that changes default
-* locations is `repointing`, after every selected mover has completed and been
-* verified. */
+/**
+* The durable coordinator state machine.
+*
+* `blocking`:
+*   planning → pausing → moving → verifying → repointing → refreshing → resuming → done
+*
+* `nonBlocking`:
+*   planning → sealing → pausing → repointing → refreshing → resuming → draining → verifying → done
+*
+* Same phases, different order plus two new ones — not a second mover.
+* `sealing` closes the `eventMedia` NULL-row hole BEFORE anything is paused;
+* `draining` runs the same movers UNLEASED, after every writer is back up.
+* `repointing` is still the only phase that changes a default location.
+*/
 var StorageMigrationPhaseSchema = zod.z.enum([
 	"planning",
+	"sealing",
 	"pausing",
 	"moving",
+	"draining",
 	"verifying",
 	"repointing",
 	"refreshing",
@@ -2282,6 +2361,9 @@ var StorageMigrationMoveSchema = zod.z.object({
 var StorageMigrationJobSchema = zod.z.object({
 	jobId: zod.z.string(),
 	phase: StorageMigrationPhaseSchema,
+	/** Which order this job is running. `status` is the only place an operator
+	*  can tell a seconds-long cutover from a thirty-hour one. */
+	mode: StorageMigrationModeSchema,
 	destinations: StorageMigrationDestinationsSchema,
 	throttleMbps: zod.z.number(),
 	moves: zod.z.array(StorageMigrationMoveSchema),
@@ -2294,13 +2376,54 @@ var StorageMigrationJobSchema = zod.z.object({
 	finishedAt: zod.z.number().nullable(),
 	error: zod.z.string().nullable()
 });
+/**
+* What the planner NOTICED but did not refuse.
+*
+* A refusal throws — the operator cannot miss it. A finding is the other half:
+* something true about this plan that changes what the operator should expect,
+* surfaced where they read it rather than in a document they will not open.
+*
+*  - `sharesDeviceWithSource` — the destination realpath's to the same place as
+*    the source. The move will be a row re-stamp, not a byte move, and it buys
+*    no redundancy. NOTE: this is PATH identity, not `st_dev` — two distinct
+*    directories on one filesystem are NOT detected. See
+*    `deviceIdentityUnknown`.
+*  - `deviceIdentityUnknown` — a location carries a `nodeId` other than this
+*    one (or has no `basePath`), so its realpath cannot be taken here and the
+*    same-device question was not answered at all. Stated rather than assumed
+*    clear: a check that silently never fires is worse than no check.
+*  - `unstampedEventMediaRows` — how many `eventMedia`/retrain rows still carry
+*    no `locationId`. Non-zero refuses a `nonBlocking` cutover.
+*  - `blockingOnly` — this class is `cardinality: 'single'`, so it can never
+*    span two locations and can only ever be moved stop-the-world.
+*  - `noMover` — the class is selectable and planned, but no addon owns a mover
+*    for it. The migration cannot move its bytes.
+*/
+var StorageMigrationFindingCodeSchema = zod.z.enum([
+	"sharesDeviceWithSource",
+	"deviceIdentityUnknown",
+	"unstampedEventMediaRows",
+	"blockingOnly",
+	"noMover"
+]);
+var StorageMigrationFindingSchema = zod.z.object({
+	code: StorageMigrationFindingCodeSchema,
+	storageClass: StorageMigrationClassSchema,
+	/** Human-readable, already carrying the ids and counts. */
+	message: zod.z.string()
+});
 var StorageMigrationPlanSchema = zod.z.object({
 	destinations: StorageMigrationDestinationsSchema,
+	/** The mode this plan was built for. A plan is only valid for its mode: the
+	*  `eventMedia` seal gate and the single-cardinality refusal both depend on
+	*  it. */
+	mode: StorageMigrationModeSchema,
 	moves: zod.z.array(zod.z.object({
 		storageClass: StorageMigrationClassSchema,
 		fromLocationId: zod.z.string(),
 		toLocationId: zod.z.string()
-	}))
+	})),
+	findings: zod.z.array(StorageMigrationFindingSchema)
 });
 //#endregion
 //#region src/interfaces/server-analysis.ts
@@ -18630,6 +18753,17 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* How many media / retrain rows still carry NO `locationId`.
+		*
+		* A NULL row means "wherever `eventMedia` points NOW", so the instant a
+		* repoint moves that pointer every such row reads from the new disk while
+		* its bytes are on the old one — the archive goes dark until a drain
+		* happens to stamp it. This count is what the migration planner's
+		* non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
+		* it to zero.
+		*/
+		countUnstampedEventMedia: require_sleep.method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
 		/** Every relocate job this addon knows about, newest first (in RAM: the
 		*  move is resumable, so a lost list costs nothing but the display). */
 		listRelocateMediaJobs: require_sleep.method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -21702,7 +21836,24 @@ var storageCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		deleteLocation: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.void(), {
+		/**
+		* Remove a location record. REFUSES a location that still holds data —
+		* deleting a drained location whose durable rows still name it is how this
+		* hub acquired 2 131 ghost `recordings:high` segments, and playback does
+		* not stat, so the operator sees a silent black window rather than an
+		* error.
+		*
+		* `force` exists because the occupancy check is BEST-EFFORT and refuses on
+		* "unknown" as well as on "occupied" (a read that fails must not authorise
+		* a destruction — D49). A location on a removed disk, on another node, or
+		* behind a remote provider answers "unknown" forever, and a refusal an
+		* operator cannot override is its own failure mode. `force: true` is
+		* logged, loudly, with what the check saw.
+		*/
+		deleteLocation: require_sleep.method(zod.z.object({
+			id: zod.z.string(),
+			force: zod.z.boolean().optional()
+		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -26657,6 +26808,33 @@ var intercomCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [require_sleep.DeviceType.Camera],
+	/**
+	* **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+	*
+	* Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+	* cap has no configuration surface at all: all six methods open, feed and
+	* close one live audio session against one `deviceId`. That is the same
+	* authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+	* the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+	* `admin` because they change what the device IS.
+	*
+	* `protected` does not mean ungated: `protectedProcedure` runs the
+	* `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+	* with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+	* grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+	* only) still cannot talk, and a grant on camera 5 cannot talk through
+	* camera 7.
+	*
+	* Every method was `auth: 'admin'` from the initial commit, which made the
+	* cap unreachable by every non-admin principal — `adminProcedure` throws
+	* `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+	* machinery generated for this cap (`METHOD_ACCESS_MAP`,
+	* `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+	* `camera-operator` scope preset has promised "PTZ control, intercom,
+	* snapshots" since that same commit; the promise could not be kept. Recorded
+	* as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+	* preset promises a cap no row of that preset can reach.
+	*/
 	methods: {
 		/**
 		* Open a server-side WebRTC audio-only session. Returns an SDP
@@ -26669,7 +26847,7 @@ var intercomCapability = {
 			sdpOffer: zod.z.string()
 		}), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		handleAnswer: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
@@ -26677,7 +26855,7 @@ var intercomCapability = {
 			sdpAnswer: zod.z.string()
 		}), zod.z.void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close explicitly. Server also auto-closes on 30s idle. */
 		stopSession: require_sleep.method(zod.z.object({
@@ -26685,7 +26863,7 @@ var intercomCapability = {
 			sessionId: zod.z.string()
 		}), zod.z.void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -26698,7 +26876,7 @@ var intercomCapability = {
 		*/
 		startTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ sessionId: zod.z.string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Push one chunk of talk-back audio onto the active talk session.
@@ -26733,12 +26911,12 @@ var intercomCapability = {
 			sequenceNumber: zod.z.number().int()
 		}), zod.z.object({ accepted: zod.z.boolean() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close the raw-PCM talk session. Idempotent. */
 		endTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		})
 	},
 	events: { onStatusChanged: { data: zod.z.object({
@@ -40712,6 +40890,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.countUnstampedEventMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45954,7 +46138,7 @@ var SCOPE_PRESETS = [
 	{
 		id: "camera-operator",
 		label: "Camera operator",
-		description: "Everything `camera-viewer` does plus PTZ control, intercom, snapshots and recording start/stop. Cannot delete devices or recordings.",
+		description: "Everything `camera-viewer` does plus live control of every granted camera — PTZ movement, intercom talk-back and on-demand snapshots. Cannot delete devices, and grants nothing on system-scope caps (recording control, users, addons).",
 		rows: [{
 			type: "category",
 			target: "device",
@@ -51077,6 +51261,7 @@ exports.MediaFileSchema = MediaFileSchema;
 exports.MediaPlayerRepeatSchema = MediaPlayerRepeatSchema;
 exports.MediaPlayerStateSchema = MediaPlayerStateSchema;
 exports.MediaPlayerStatusSchema = MediaPlayerStatusSchema;
+exports.MediaRelocateModeSchema = MediaRelocateModeSchema;
 exports.MeshPeerSchema = MeshPeerSchema;
 exports.MeshStatusSchema = MeshStatusSchema;
 exports.MethodAccessSchema = MethodAccessSchema;
@@ -51454,11 +51639,14 @@ exports.StorageLocationSchema = StorageLocationSchema;
 exports.StorageLocationTypeSchema = StorageLocationTypeSchema;
 exports.StorageMigrationClassSchema = StorageMigrationClassSchema;
 exports.StorageMigrationDestinationsSchema = StorageMigrationDestinationsSchema;
+exports.StorageMigrationFindingCodeSchema = StorageMigrationFindingCodeSchema;
+exports.StorageMigrationFindingSchema = StorageMigrationFindingSchema;
 exports.StorageMigrationFootageMoveInputSchema = StorageMigrationFootageMoveInputSchema;
 exports.StorageMigrationInputSchema = StorageMigrationInputSchema;
 exports.StorageMigrationJobSchema = StorageMigrationJobSchema;
 exports.StorageMigrationLeaseInputSchema = StorageMigrationLeaseInputSchema;
 exports.StorageMigrationMediaMoveInputSchema = StorageMigrationMediaMoveInputSchema;
+exports.StorageMigrationModeSchema = StorageMigrationModeSchema;
 exports.StorageMigrationMoveSchema = StorageMigrationMoveSchema;
 exports.StorageMigrationParticipantSchema = StorageMigrationParticipantSchema;
 exports.StorageMigrationPhaseSchema = StorageMigrationPhaseSchema;
@@ -51534,6 +51722,7 @@ exports.UNATTRIBUTED_BUCKET_KEY = UNATTRIBUTED_BUCKET_KEY;
 exports.UNIT_TABLE = UNIT_TABLE;
 exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
 exports.UnitConversionError = UnitConversionError;
+exports.UnstampedEventMediaCountSchema = UnstampedEventMediaCountSchema;
 exports.UpdateIntegrationInputSchema = UpdateIntegrationInputSchema;
 exports.UpdateStatusSchema = UpdateStatusSchema;
 exports.UpdateUserInputSchema = UpdateUserInputSchema;